Outlook vulnerability CVE-2026-124194: exploited zero-day that leaks credentials, Microsoft November 2026 patches

The short answer: Microsoft’s 10 November 2026 security updates fix CVE-2026-124194, an Outlook flaw that Microsoft reports as exploited. An attacker sends a crafted message file; if the user opens it, Outlook connects to the attacker’s server without the usual warning and hands over the user’s NTLMv2 hash, which can be reused to impersonate them. CISA added it to its catalogue of exploited vulnerabilities the same day. Update Microsoft 365 Apps and Office LTSC on every PC, then install the November Windows cumulative update, which also fixes critical LDAP and Active Directory flaws.

Microsoft rates the flaw “Moderate”. Do not let that reassure you: it is the only flaw in this Patch Tuesday already used in attacks, and it targets the tool your staff keep open all day. In the Moroccan SMBs we support, attachments flow constantly between customers, suppliers and public bodies; a credential stolen this way can then open access to email, file shares or the VPN.

What is affected

CVE-2026-124194 (Microsoft Outlook, spoofing): according to Microsoft, Outlook’s interface does not warn the user about an unsafe action, which lets an unauthenticated attacker perform spoofing over a network. The vendor’s scenario:

• the attacker sends a specially crafted message file or Office file;
• the user opens it in an affected version of Outlook;
• Outlook connects to an attacker-controlled network location without the external-content warning;
• the user’s NTLMv2 hash is disclosed and can be used to authenticate as them.

Microsoft states that the Preview Pane is not an attack vector: user action is required.

Product	Affected versions	Fixed version
Office LTSC 2024 (32 and 64-bit)	builds before 16.0.17932.21140	16.0.17932.21140
Office LTSC 2021 (32 and 64-bit)	builds before 16.0.14334.21048	16.0.14334.21048
Microsoft 365 Apps, Current Channel	versions before build 20527.20196	Version 2610, build 20527.20196
Microsoft 365 Apps, Monthly Enterprise Channel	versions before the 10 November builds	Version 2610 (20527.20194), 2609 (20430.20264) or 2608 (20326.20320)
Microsoft 365 Apps, Semi-Annual Enterprise Channel	versions before the 10 November builds	Version 2610 (20527.20192), 2609 (20430.20262) or 2608 (20326.20318)

Source: Microsoft Security Update Guide (MSRC), CVE-2026-124194, and Microsoft’s Microsoft 365 Apps security updates page, 10 November 2026 releases.

Office 2016 and Office 2019 have been out of support since October 2025, as the DGSSI’s maCERT pointed out: a PC still running those versions should not be considered protected.

Severity and exploitation

• Published severity: Microsoft rates the flaw “Moderate” with a CVSS 3.1 score of 6.5. The impact is a high loss of confidentiality.
• Exploitation: Microsoft marks it “Exploitation Detected”. CISA added it to its KEV catalogue on 10 November 2026, with a 24 November deadline for US federal agencies and a forensic triage requirement. The NVD reflects the catalogue entry.
• Public disclosure: no, according to Microsoft.
• Workaround: Microsoft’s advisory offers none. Only the Office update fixes the flaw.
• maCERT: at the time of writing, we had not found a DGSSI bulletin dedicated to the November Patch Tuesday. We will update this article if one is published.

Other Microsoft November fixes not to miss

The 10 November release is a record in volume according to the specialist press. No other flaw is reported as exploited, but several critical flaws matter directly to SMBs. The monthly Windows cumulative update fixes them:

• Windows LDAP, CVE-2026-119958: remote code execution through a series of LDAP calls, without authentication, scored 9.8 by Microsoft. Domain controllers are the first servers to patch.
• Active Directory Domain Services, CVE-2026-118146: code execution on the server by an attacker with a low-privilege account, scored 8.8 and “Exploitation More Likely”.
• Exchange Server Subscription Edition, CVE-2026-118207: code execution by an authenticated user, with no user interaction, scored 8.8 and “Exploitation More Likely”. Fixed by KB5133453 (build 15.02.2562.057).
• Outlook, Word and Excel: several critical code execution flaws triggered by a crafted document, fixed by the same Office builds as above.

Windows	November update	Fixed build
Windows 11 24H2	KB5132061 or KB5132043	26100.9974 or 26100.9911
Windows 11 23H2	KB5131087	22631.7711
Windows 11 26H1	KB5132059	28000.3501
Windows 10 21H2 / 22H2	KB5131096	19044.7846 / 19045.7846
Windows Server 2025	KB5131080 or KB5131077	26100.33822 or 26100.33730
Windows Server 2022	KB5131090	20348.5870
Windows Server 2019	KB5131085	17763.9487
Windows Server 2016	KB5131291	14393.9688

Source: Microsoft Security Update Guide, CVE-2026-119958 and CVE-2026-118146. For Windows 11 25H2 and 26H2, the advisory lists the matching 26200 and 26300 builds.

Checks to run

1. Check the Office version on every PC: in Outlook, File, Office Account, compare the build number with the table. On Microsoft 365 Apps, run “Update Now” then restart Outlook; an update that is downloaded but not applied gives no protection.
2. Find any Office 2016 and 2019 still installed: they no longer receive fixes. Replacing them with Microsoft 365 Apps or Office LTSC is the only lasting answer.
3. Block outbound SMB to the internet: NTLM hash leaks rely on a connection to the attacker’s server. On your firewall, deny outbound connections on TCP port 445 to the internet if your business does not need them, and check the rule on laptops that work off-site.
4. Protect sensitive accounts: put administrator accounts in the Active Directory “Protected Users” group and reduce NTLM use where Kerberos is enough, after testing.
5. Install the Windows cumulative update on every PC and server, starting with domain controllers, then check the build with winver.
6. Deal with on-premises Exchange: install KB5133453 on Exchange Server Subscription Edition and check the build shown by the server.
7. Look for traces: unusual outbound SMB or WebDAV connections from PCs to external addresses, account sign-ins from unknown machines, and antivirus or EDR alerts since early November.

Our view for businesses in Morocco

This flaw does not target an exposed server: it targets the user and their inbox, like the Windows Shell zero-day fixed last month and covered in our alert on Microsoft’s October 2026 patches. The most exposed fleets are those where nobody knows which PCs have actually applied the Office updates, and those that keep old Office versions installed “because they work”. Structured patch management, backed by Microsoft Intune, solves that. On the email side, the 10 settings to secure Microsoft 365 cut the number of booby-trapped files that reach users, and our examples of phishing scams targeting SMBs in Morocco help raise staff awareness. Finally, managed EDR with 24/7 monitoring can spot an abnormal outbound connection even before the fix is everywhere.

How we can help

As a Microsoft partner, we update Office and Windows on your PCs and servers, check the builds actually installed, replace unsupported Office versions, harden firewall rules and provide 24/7 monitoring, with critical incidents handled in under 15 minutes. Read about our approach to business cybersecurity in Morocco, then request your free initial audit: we reply within 24 business hours.

Sources: Microsoft Security Update Guide, CVE-2026-124194, CVE-2026-119958, CVE-2026-118146, CVE-2026-118207, Microsoft 365 Apps security updates, CISA alert of 10 November 2026, CISA KEV catalogue, NVD CVE-2026-124194, maCERT bulletin on Office 2016 and 2019 end of support.